user/sven/linux.git/drivers/scsi/pmcraid.c, branch v3.4.78

SCSI, pmcraid: Fix spelling error in a pmcraid_err() call

2011-12-15T15:35:38Z

There's a mistake in one of the pmcraid_err() calls in drivers/scsi/pmcraid.c - 'failed' is misspelled as 'faile'. This patch fixes that error. PS. This patch is generated on top of my previous one "[PATCH] SCSI, pmcraid: Fix kmalloc() argument order in pmcraid_chr_ioctl()". Signed-off-by: Jesper Juhl Signed-off-by: Jiri Kosina

[SCSI] pmcraid: pmcraid_chr_ioctl uses incorrect argument order to kmalloc()

2011-10-30T10:06:58Z

Size is 1st arg, not second. Signed-off-by: Dave Jones Signed-off-by: James Bottomley

Merge branch 'master' into for-next

2011-09-15T13:08:18Z

Fast-forward merge with Linus to be able to merge patches based on more recent version of the tree.

Remove unneeded version.h includes from drivers/scsi/

2011-09-15T12:57:07Z

It was pointed out by 'make versioncheck' that some includes of linux/version.h are not needed in drivers/scsi/. This patch removes them. Signed-off-by: Jesper Juhl Signed-off-by: Jiri Kosina

[SCSI] pmcraid: reject negative request size

2011-07-27T13:26:21Z

There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. First, the user can call pmcraid_chr_ioctl(), with a type PMCRAID_PASSTHROUGH_IOCTL. This calls through to pmcraid_ioctl_passthrough(). Next, a pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. It looks like preventing this value from being negative in pmcraid_ioctl_passthrough() would be sufficient. Signed-off-by: Dan Rosenberg Cc: Signed-off-by: Andrew Morton Signed-off-by: James Bottomley

Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6

2011-05-26T20:19:00Z

* 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6: gfs2: Drop __TIME__ usage isdn/diva: Drop __TIME__ usage atm: Drop __TIME__ usage dlm: Drop __TIME__ usage wan/pc300: Drop __TIME__ usage parport: Drop __TIME__ usage hdlcdrv: Drop __TIME__ usage baycom: Drop __TIME__ usage pmcraid: Drop __DATE__ usage edac: Drop __DATE__ usage rio: Drop __DATE__ usage scsi/wd33c93: Drop __TIME__ usage scsi/in2000: Drop __TIME__ usage aacraid: Drop __TIME__ usage media/cx231xx: Drop __TIME__ usage media/radio-maxiradio: Drop __TIME__ usage nozomi: Drop __TIME__ usage cyclades: Drop __TIME__ usage

[SCSI] pmcraid: reject negative request size

2011-04-24T17:15:07Z

There's a code path in pmcraid that can be reached via device ioctl that causes all sorts of ugliness, including heap corruption or triggering the OOM killer due to consecutive allocation of large numbers of pages. Not especially relevant from a security perspective, since users must have CAP_SYS_ADMIN to open the character device. First, the user can call pmcraid_chr_ioctl() with a type PMCRAID_PASSTHROUGH_IOCTL. A pmcraid_passthrough_ioctl_buffer is copied in, and the request_size variable is set to buffer->ioarcb.data_transfer_length, which is an arbitrary 32-bit signed value provided by the user. If a negative value is provided here, bad things can happen. For example, pmcraid_build_passthrough_ioadls() is called with this request_size, which immediately calls pmcraid_alloc_sglist() with a negative size. The resulting math on allocating a scatter list can result in an overflow in the kzalloc() call (if num_elem is 0, the sglist will be smaller than expected), or if num_elem is unexpectedly large the subsequent loop will call alloc_pages() repeatedly, a high number of pages will be allocated and the OOM killer might be invoked. Prevent this value from being negative in pmcraid_ioctl_passthrough(). Signed-off-by: Dan Rosenberg Cc: stable@kernel.org Cc: Anil Ravindranath Signed-off-by: James Bottomley

pmcraid: Drop DATE usage

2011-04-18T22:23:22Z

The kernel already prints its build timestamp during boot, no need to repeat it in random drivers and produce different object files each time. Cc: Anil Ravindranath Cc: linux-scsi@vger.kernel.org Signed-off-by: Michal Marek

Fix common misspellings

2011-03-31T14:26:23Z

Fixes generated by 'codespell' and manually reviewed. Signed-off-by: Lucas De Marchi

[SCSI] remove flush_scheduled_work() usages

2011-02-12T16:31:02Z

Simple conversions to drop flush_scheduled_work() usages in drivers/scsi. More involved ones will be done in separate patches. * NCR5380, megaraid_sas: cancel_delayed_work() + flush_scheduled_work() -> cancel_delayed_work_sync(). * mpt2sas_scsih: drop unnecessary flush_scheduled_work(). * arcmsr_hba, ipr, pmcraid: flush the used work explicitly instead of using flush_scheduled_work(). Signed-off-by: Tejun Heo Signed-off-by: James Bottomley